Compute Engine Metadata Ssrf Privilege Escalation

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise hosts a customer-facing application on Google Compute Engine virtual machines. During a penetration test, security analysts discover a Server-Side Request Forgery (SSRF) vulnerability that allows external actors to inject custom HTTP request headers and query the instance metadata server (http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token). The red team demonstrated that by stealing the default Compute Engine service account token, they could leverage overly broad IAM permissions to modify the instance startup-script metadata on other production virtual machines, achieving remote code execution and privilege escalation.

Which strategy should the security engineer implement to remediate this attack vector and detect subsequent exploitation attempts?

Configure a VPC egress firewall rule to deny all internal network traffic to the link-local metadata IP address 169.254.169.254.

Rely entirely on the Metadata-Flavor: Google header check on the metadata server and deploy Cloud IDS to block Layer 7 HTTP requests targeted at 169.254.169.254.

Implement Cloud Storage Bucket Lock on instance logging buckets and enforce Binary Authorization on the Compute Engine virtual machine instances.

Assign dedicated, least-privilege service accounts to VMs lacking metadata modification roles, and monitor Security Command Center Event Threat Detection for Compute Engine Admin Added Startup Script findings.

Professional Cloud Security Engineer

Compute Engine Metadata Ssrf Privilege Escalation

Related questions